Bugtraq mailing list archives
Re: [Full-disclosure] trusting SMTP [was: SendGate: Sendmail Multiple Vulnerabilities]
From: Valdis.Kletnieks () vt edu
Date: Fri, 24 Mar 2006 05:13:46 -0500
On Thu, 23 Mar 2006 03:59:20 CST, Gadi Evron said:
Oh, sorry for not mentioning earlier - Operators that want to patch Sendmail, I'd suggest doing it soon. Now we not only do we face risk to our mail servers, but rather trusting other servers as well.
Been there, done that. All the same issues we saw when 8.12.9 came out: 8.12.9/8.12.9 2003/03/29 SECURITY: Fix a buffer overflow in address parsing due to a char to int conversion problem which is potentially remotely exploitable. Problem found by Michal Zalewski. Note: an MTA that is not patched might be vulnerable to data that it receives from untrusted sources, which includes DNS. So just like last time - I'm sure somebody will patch their external-facing mailserver *first*, and that lets exploit mail get through the external mailer and reach the internal mailserver (where before it would just have 0wned the external server). Not that Sendmail is any different from any OTHER infrastructure software. The exact same issues apply when an IOS bug is found, or an NTP bug, or..... (And if you think Sendmail didn't do a good job of releasing the info, I shudder to think of what you thought of how Cisco handled the whole Lynn thing ;)
Attachment:
_bin
Description:
Current thread:
- SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Gadi Evron (Mar 23)
- trusting SMTP [was: SendGate: Sendmail Multiple Vulnerabilities] Gadi Evron (Mar 23)
- Re: [Full-disclosure] trusting SMTP [was: SendGate: Sendmail Multiple Vulnerabilities] Valdis . Kletnieks (Mar 24)
- Re: [Full-disclosure] SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Dragos Ruiu (Mar 23)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Theo de Raadt (Mar 24)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Martin Schulze (Mar 24)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Theo de Raadt (Mar 24)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) D.F.Russell (Mar 25)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Kurt Seifried (Mar 27)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Gadi Evron (Mar 25)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Geo. (Mar 28)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Martin Schulze (Mar 24)
- trusting SMTP [was: SendGate: Sendmail Multiple Vulnerabilities] Gadi Evron (Mar 23)